WordPress Plugin Vulnerabilities

NEX-Forms < 9.1.4 - Cross-Site Request Forgery

Description

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.1.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
nex-forms-express-wp-form-builder
Fixed in 9.1.4

References

CVE
CVE-2025-49399
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f6bdd745-066d-4b8e-a66c-6d3fb9a9ef12

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
19694583-19df-4669-9514-f8e84a63541d

Timeline

Publicly Published
2025-08-20 (about 10 months ago)
Added
2025-08-26 (about 9 months ago)
Last Updated
2025-08-26 (about 9 months ago)

Other

Published
Title
Published
2025-03-27
Title
Christmas Panda < 1.1.0 - Cross-Site Request Forgery
Published
2025-10-24
Title
Advanced Database Cleaner < 3.1.7 - Settings Manipulation via CSRF
Published
2024-12-12
Title
ECT Social Share <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-01-30
Title
Post Video Players < 1.160 - Settings Update via CSRF
Published
2023-05-11
Title
Forget About Shortcode Buttons < 2.1.3 - CSRF